{"url":"https://satos.hatenablog.jp/entry/2016/09/20/004119","width":"100%","blog_url":"https://satos.hatenablog.jp/","type":"rich","provider_url":"https://hatena.blog","blog_title":"\u5fd6\u5ea6","published":"2016-09-20 00:41:19","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fsatos.hatenablog.jp%2Fentry%2F2016%2F09%2F20%2F004119\" title=\"csaw ctf 2016 quals\u306eTutorial\u306ewriteup - \u5fd6\u5ea6\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","provider_name":"Hatena Blog","categories":[],"version":"1.0","author_url":"https://blog.hatena.ne.jp/satos___jp/","image_url":null,"author_name":"satos___jp","description":"Tutorial (pwn 200) \u691c\u5206 stripped\u3067\u306a\u3044x86_64\u30d0\u30a4\u30ca\u30ea\u3002libc\u3082\u3082\u3089\u3048\u308b\u3002 NX\u3042\u308a\u3001\u30ab\u30ca\u30ea\u30fc\u3042\u308a\u3001PIE\u306a\u3057\u3002\u6319\u52d5\u306f\u5927\u96d1\u628a\u306b\u3001 void priv(){ /* \u30eb\u30fc\u30c8\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092/home/tutorial\u306b\u3057\u305f\u308a\u3001 tutorial\u306euid,gid\u306b\u5909\u66f4\u3057\u305f\u308a\u3059\u308b\u3002 */ } func1(int fd){ void* p = dlsym(-1,\"puts\"); //[rbp-0x48] write(fd,\"rifarense\"); sprintf(rbp-0x40,\"%p\\n\",p); write(fd,rbp-0x40,len=15); } func2\u2026","title":"csaw ctf 2016 quals\u306eTutorial\u306ewriteup","height":"190"}